Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 17:15
Behavioral task
behavioral1
Sample
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe
-
Size
18.6MB
-
MD5
05af8059269d76cb7f5929bd03953749
-
SHA1
a614ff5395c53a8cf0fdee31dd6fcc32277faae3
-
SHA256
92f91b9e78c49bd39cc7a446f4d63dec275d34da99d2d5ed742a069be41ce77b
-
SHA512
5e6470d76ed3575b446e84b4a8734a9d0e92fe4bc98266ce06861464379071f094e3974ef259f9fc580f78f8286f220ac3201436ceae444765391bda8013fdb1
-
SSDEEP
393216:TFgRsWeW0QfSWgyzPpeSKfFgRsWeW0QfSWgyzPpeSKS2:o0yTjKU0yTjKB
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1136-0-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon C:\Program Files\TraceEnter.exe family_blackmoon behavioral1/memory/1136-166-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon -
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
XMRig Miner payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1136-0-0x0000000000400000-0x0000000000619000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\TraceEnter.exe xmrig behavioral1/memory/2300-82-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-147-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1136-166-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral1/memory/2300-198-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-249-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-294-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-348-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-349-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-350-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-351-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-352-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-375-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-376-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-377-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2300-378-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2300 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1136-0-0x0000000000400000-0x0000000000619000-memory.dmp upx C:\Program Files\TraceEnter.exe upx behavioral1/memory/1136-166-0x0000000000400000-0x0000000000619000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\EhStorAuthn.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\systeminfo.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfpmp.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\mountvol.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\powercfg.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\AdapterTroubleshooter.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\bootcfg.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\dvdplay.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\mcbuilder.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\sxstrace.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpnsvr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\recover.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\winver.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\at.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\ocsetup.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\PushPrinterConnections.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\attrib.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\RpcPing.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\schtasks.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\xlog.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\mighost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\net1.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\vssadmin.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\wextract.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\getmac.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\fltMC.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftp.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\wevtutil.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\cacls.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\extrac32.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\logman.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\wusa.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmdl32.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\msdt.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\pcaui.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\shrpubw.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\DWWIN.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\DpiScaling.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntprint.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\driverquery.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\systray.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\Windows Journal\Journal.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\DVD Maker\DVDMaker.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wabmig.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\WMPDMC.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a\winload.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\Solitaire.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661\smss.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd\SpeechUXWiz.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\msil_presentationfontcache_31bf3856ad364e35_6.1.7600.16385_none_0da126f11187fafa\PresentationFontCache.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-processmodel_31bf3856ad364e35_6.1.7601.17514_none_1f3c3defefc3a10e\w3wp.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-credwiz_31bf3856ad364e35_6.1.7600.16385_none_9fb106cecd28b3f9\credwiz.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\wmpconfig.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\showmount.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7601.17514_none_cde4c4fd7ab159cb\RMActivate_ssp.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\qprocess.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_c718d071d9c10a2d_auditpol.exe_83c870f4 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnscacheugc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_0c19cef0ed2a642e\setup_wm.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89\winresume.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netsh_31bf3856ad364e35_6.1.7600.16385_none_bb95e7e51189d8f9\netsh.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7601.17514_none_f387767e655cd5ab\cmd.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.2.9600.16428_none_b436382b203656be\ExtExport.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\ehome\CreateDisc\SBEServer.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_8fbb77bb3cd808d1\pcalua.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\TRACERT.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\WMIADAP.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_d18028273214fa77\SearchProtocolHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\user.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7601.17514_none_0a379bcfbdcffb74\PDMSetup.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\accicons.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setupcl_31bf3856ad364e35_6.1.7601.17514_none_b6d50b4301e77815\setupcl.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_6.1.7601.17514_none_c82fdb5265bc18af\SndVol.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.7600.16385_none_2106a98149904819\ielowutil.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-label_31bf3856ad364e35_6.1.7600.16385_none_b323fd6ee3f98653\label.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSSVC.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.1.7601.17514_none_e46b048a01806891\msinfo32.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_6.1.7600.16385_none_4b49a2c2123fd42c\systeminfo.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_6.1.7600.16385_none_a0d95afc49c833b6\dispdiag.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_6.1.7600.16385_none_3580dea4def227d4\esentutl.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_6.1.7600.16385_none_b65cdbcf116dd7c5\WMSvc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\Hearts.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_43d2529dd579f798\taskeng.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_5a768666c3091014\dw20.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_6.1.7600.16385_none_ca61f601a4548b8e\setup.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\NETFXRepair.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a_winload.exe_75835076 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a_vdsldr.exe_20c491b3 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_6.1.7600.16385_none_ca61f601a4548b8e\_isdel.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchFilterHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\write.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_0c19cef0ed2a642e\unregmp2.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\clrgc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_bfab9b4ba5f934f9_netiougc.exe_94123cfe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_092d6b9141f16aca_winmgmt.exe_8f8eb7b1 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-magnify_31bf3856ad364e35_6.1.7600.16385_none_ca22c913b260e66a\Magnify.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 1136 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Token: 33 1136 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1136 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2300 svchost.exe Token: SeLockMemoryPrivilege 2300 svchost.exe Token: SeLockMemoryPrivilege 2300 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exepid process 1136 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription pid process target process PID 1136 wrote to memory of 2300 1136 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe svchost.exe PID 1136 wrote to memory of 2300 1136 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe svchost.exe PID 1136 wrote to memory of 2300 1136 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe svchost.exe PID 1136 wrote to memory of 2300 1136 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\TraceEnter.exeFilesize
19.0MB
MD56cd2716591a2e96bf19a03b0fdf05a01
SHA19cb3effc1337385f9f0fd97b7fbe713f8d979f6c
SHA25671a723445074fa4f91ef920399e7fba681485c2f04413547cefca241f8f75c92
SHA51279a2c89fc663836fe840c80d065e109f4b8e5a1ea8f6408fb2f6446c3fd1f7b50a3bf6e4074975634809a116be020696e4ea662bddbc02558b3c33cc7a3d7008
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
memory/1136-166-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/1136-0-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/2300-249-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-350-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-198-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-82-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-294-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-348-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-349-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-147-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-351-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-352-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-375-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-376-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-377-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2300-378-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB